Java sensitive data: char[] vs String? What is the point?

Question

We already know about this suggestion/practice to use char[] instead of String for sensitive data. There is multiple reasons for it. One is to clean up the sensitive data right after they are not needed anymore:

char[] passwd = passwordProvider.getKeyStorePassword();
KeyStore keystore = KeyStore.getInstance("JKS");

// TODO: Create the input stream;
keystore.load(inputstream, passwd);

System.arraycopy(new char[passwd.length], 0, passwd, 0, passwd.length);

// Please continue...

Now the question: does it (i.e. using char[]) make sense (specifically the point mentioned above), when the sensitive data comes to you originally as String value? for example:

char[] passwd = passwordProvider.getKeyStorePassword().toCharArray();
KeyStore keystore = KeyStore.getInstance("JKS");

// TODO: using the passwd, load the keystore;

System.arraycopy(new char[passwd.length], 0, passwd, 0, passwd.length);

// Please continue...

Thanks in advance.

UPDATE2: I'll rephrase the question: in this specific context (forget about changes in future or anything else), does the line "clearing the content of char array" do any good?

UPDATE1: it's not a duplication of Why is char[] preferred over String for passwords? I know what the story is. I'm asking in this specific context, does it still make sense?

Answer 1

It seems to me that it's a security problem in the design of the API of the password provider that it returns a String.

But, if you have to work with that API, converting to char[] immediately means that you aren't preventing the String instance from being GC'd, because you're not holding a reference to it for any longer than is absolutely necessary.

So, it makes sense to use char[] here because you "aren't making it worse".